[Snort-users] Smb output
frank at ...9761...
Wed Jul 21 13:44:09 EDT 2004
On Wed, 2004-07-21 at 01:22, Nerijus Krukauskas wrote:
> Smb alerting would be soooo sloooow, that snort would start
> dropping packets very soon and very fast.
Is that really the case? Isn't the SMB alert just a single UDP packet?
If so, it would be comparable to a TCP reset packet. Does that slow
Snort down that much? Perhaps the SMB plugin just needs to be optimized
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 187 bytes
Desc: This is a digitally signed message part
More information about the Snort-users